[kixelated]

Adds quest/m1/egress-held-state.md and ranks it in m1 right after Rust request credit. Planning only; nothing is implemented.

Why

The egress audit in #5958 found that a downstream withholding stream credit across many tracks can make a relay hold an unbounded number of group serve machines, and with an inert cache pool unbounded bytes too. Verified on 8380595:

• Lite TrackRun::serve (rs/moq-net/src/lite/publisher.rs:3722-3744) and IETF TrackServe (rs/moq-net/src/ietf/publisher.rs:4002) create one machine per group with no in-flight bound. Each waits in Open for stream credit.
• The Open arms check only expiry (lite/publisher.rs:3862-3867, ietf/publisher.rs:4697), and expiry_pending is false once a group is aborted (model/group.rs:1924, 2174-2181). So a group the pool's 30 s idle window evicts leaves its machine parked forever.
• The serving budget is about 2^53 ms for peers whose wire has no max delay (MAX_SAFE_DELAY_MS, lite/publisher.rs:90-104, ietf/publisher.rs:30-42). New finding: a lite-03+ peer can also name any max delay it likes (lite/subscribe.rs:65). Only cache_duration (Duration::MAX by default, model/origin.rs:160) or the publisher's max_age clamps it.
• Session limits cap subscriptions and fetches only (rs/moq-relay/src/limits.rs, 1000/10000 per client session). Nothing caps sessions (max_incoming bounds only pending handshakes).

The quest states the goal and five abuse scenarios, including the benign one: a real viewer on a bufferbloated link must keep the live edge. It recommends directions without fixing the shape: serve state follows credit rather than arrival, unservable parked groups leave (named by SUBSCRIBE_DROP where the version allows it), and the serving budget is clamped by local retention. It also describes a reproduction (a credit-withholding or slow-draining subscriber, measuring held machines and billed bytes, swept tracks by groups) and says what done looks like.

Decisions

The maintainer approved planning this now. A background planning agent settled these, so challenge any of them in review:

1. Shape
   • ✅ One [L] quest. Credit-driven serving would also remove the aborted-group leak, so splitting off the smaller fixes risks doing that work twice.
   • An epic with three children (aborted groups leave, budget clamp, in-flight bound)
2. Sessions cap
   • ✅ Out of scope, recorded as a separate admission-control concern. A count cap would be a constant that only throws, and auth plus per-session limits already price a session.
   • Add a session cap to this quest
3. m1 rank
   • ✅ Right after Rust request credit, its sibling on the request side
   • At the end of m1
4. Existing quests
   • ✅ Link rather than fold: receive-memory (ingress), rs-request-credit (which leaves group streams out of scope), subscribe-drop, track-priority-scope, public-model/serve. None of them covers bounding egress group state.

Public API and wire impact

None. The quest expects no wire change and possibly a new relay cache_duration default.

quest check and just check pass.

Follow-up worth considering: an admission-control quest (sessions per token or address) if the drill shows sessions are the cheapest remaining abuse.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T19:56:58.694468Z	211cdee	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1cbf61c8b7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kixelated]

Maintainer decisions: one [L] quest; ranked right after Rust request credit; linked, not folded. Sessions: admission control (per-token or per-address caps) belongs to the deployment's auth server, which can already refuse a connect, so nothing more is needed here. 68c1fb8 records that and adds a benign withholder (a receiver bounded by the receive-memory quest) to the reproduction.

@codex review

(Written by Claude Opus 5.5)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 68c1fb8aff

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kixelated]

@codex review

(Written by Claude Opus 5.5)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 87f98ec4c6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 7 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6c709b8a-4bf9-4827-a91f-66ddc1a03411

📥 Commits

Reviewing files that changed from the base of the PR and between 6c35767 and 211cdee.

📒 Files selected for processing: 2

• quest/m1/README.md
• quest/m1/egress-held-state.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kixelated]

@codex review

(Written by Claude Opus 5.5)

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 211cdeea08

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".